Oracle BPM Suite Critical Flaw Allows Data Manipulation via HTTP

Oracle has disclosed a critical security vulnerability in its Business Process Management Suite that allows attackers to compromise sensitive data. The flaw, identified as CVE-2026-91243, is rated 9.6 on the Common Vulnerability Scoring System, placing it in the critical category. This issue impacts specific versions of the Oracle Fusion Middleware product line.

The vulnerability resides within the Fabric Layer component of the Oracle Business Process Management Suite. According to the National Vulnerability Database record, the flaw is easily exploitable by a low-privileged attacker who has network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data. Attackers may also gain complete access to all data accessible by the suite.

Scope and Impact Details

The CVSS vector for this vulnerability indicates that no user interaction is required for exploitation. The attack complexity is rated as low, and the base score of 9.6 reflects high impacts on both confidentiality and integrity. While the availability of the system is not directly impacted by the vector, the potential for data manipulation is severe.

The vulnerability involves a scope change, meaning that while the flaw is located in the Business Process Management Suite, successful attacks may significantly impact additional products. This expands the potential blast radius beyond the immediate component where the weakness was identified. Organizations using interconnected systems should consider this broader impact when assessing risk.

Affected Versions and Products

The National Vulnerability Database lists two specific supported versions as affected by this issue. These are version 12.2.1.4.0 and version 14.1.2.0.0 of the Oracle Business Process Management Suite. Administrators should verify their current installations against these version numbers to determine if their environment is exposed to this critical flaw.

No other versions are explicitly listed in the provided record as affected. However, users of adjacent versions or related middleware components should monitor vendor advisories closely, given the noted scope change that could affect additional products. The record does not specify whether other minor releases within these major version branches are also vulnerable.

What should you do?

Organizations should immediately audit their environments to identify any instances of the affected Oracle Business Process Management Suite versions. Since the vulnerability allows exploitation via HTTP, restricting network access to these services is a key mitigation strategy. Administrators should also review logs for any unauthorized data modifications or access patterns that could indicate exploitation.

What to do and how to stay safe: Oracle

• Inventory all systems running Oracle Business Process Management Suite to check for versions 12.2.1.4.0 and 14.1.2.0.0.
• Restrict HTTP network access to the affected services to limit exposure from low-privileged attackers.
• Monitor application logs for unauthorized data creation, deletion, or modification events.
• Prepare to apply updates once the vendor releases a patch for CVE-2026-91243.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-91243?

The CVSS 3.1 Base Score is 9.6, which is classified as critical severity.

Which Oracle products are affected by this vulnerability?

The Oracle Business Process Management Suite within Oracle Fusion Middleware is affected, specifically the Fabric Layer component.

What versions of the software are vulnerable?

Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected by this vulnerability.